Filebeat not setting index name even though configured

Elastic Stack Beats
1

In filebeat.yml i have set:
index: filebeat-app

yet in the json output there is nothing for index, and it still receives teh default logstash-$date index when inserted into elasticsearch.

2

did you follow the docs. At which place did you set the index? Can you share your config?

3 
output:
  logstash:
    hosts: ["logstash01:5044", "logstash02:5044", "logstash03:5044"]

    # Number of workers per Logstash host.
    worker: 16

    # Set gzip compression level.
    #compression_level: 3

    # configure logstash plugin to loadbalance events between the logstash instances
    loadbalance: true

    # configure index prefix name
    index: filebeat-app
4

I wouldn't use a monolithic index, use time based ones.
Otherwise how do you manage retention of old records?

5

Did you check the docs.

The index is exposed under [@metadata][beat] in logstash.

Sample elasticsearch output to use index name from beats:

output {
  elasticsearch {
    host => "localhost"
    port => "9200"
    protocol => "http"
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}
6

This topic was automatically closed after 21 days. New replies are no longer allowed.